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1 

2 FIELD OF THE INVENTION 

3 The present invention relates generally to compute and/or network management and more 

4 particularly to an improved system, method, apparatus, and article of manufacture for visualizing 

5 patterns of changes and behavior on a compute infrastructure such as the one shown in Figure 10. 
6 

7 BACKGROUND OF THE INVENTION 

8 Heretofore, compute infrastructure change visualization techniques involve programmed 

9 alerting generated by user defined events on individual technology components or processes. 

10 Determining what components have changed and isolating patterns of failure has been the 

1 1 responsibility of the individuals tasked with responding to alarms. As expected, the process is 

12 often time-consuming and cumbersome. 

13 Furthermore, the existing focus of alerts on component or process failures undermines the 

14 ability of individuals to identify components with a pattern of success. 

15 Accordingly, what is needed is a comprehensive way to visualize change on a compute 

16 infrastructure, and more particularly, a solution that detects and presents patterns of both positive 

1 7 and negative change on a compute infrastructure. 
18 

1 9 SUMMARY OF THE INVENTION 

20 The present invention (also called Differential View) addresses the aforementioned 

21 problems of the prior art by providing for, among other things, an improved apparatus, method 
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1 and article of manufacture for visualizing patterns of change and behavior on a compute 

2 infrastructure. Differential View provides for complete visualization of infrastructure change 

3 and behavior and further provides interactive filters that identify and display patterns of change 

4 and behavior, on a graduated scale, for the compute infrastructure as a whole and for specific 

5 groups within the infrastructure. This allows any type of compute data to be consolidated and 

6 visualized; this view can occur pre- or post- database load, or without ever loading data to a 

7 database. Furthermore, the attribute-values may represent any defined test (unit, system, 

8 performance, or industrial process). 

9 Other aspects, features and advantages of the present invention will become better 



10 understood with regard to the following description and accompanying drawings. 
11 

12 BRIEF DESCRIPTION OF THE DRAWINGS 



13 Referring briefly to the drawings, exemplary embodiments of the present invention will 

14 be described with reference to the accompanying drawings in which 

15 FIG. 1 illustrates a graphical interface of an exemplary embodiment of the present 

16 invention. 

1 7 FIG. 2 illustrates the group selection feature of an exemplary embodiment of the present 

18 invention. 

19 FIG. 3 illustrates the group analysis feature of an exemplary embodiment of the present 

20 invention. 
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1 FIG. 4 illustrates the baseline comparison feature of an exemplary embodiment the 

2 present invention. 

3 FIG. 5 illustrates the drill down feature of an exemplary embodiment of the present 

4 invention. 

5 FIG. 6 illustrates an exemplary three-dimensional view of one embodiment of the present 

6 invention. 

7 FIG. 7 illustrates the color intensity feature of an exemplary embodiment of the present 

8 invention. 

9 FIG. 8 illustrates an exemplary embodiment of the customizable timeframe feature of the 

10 present invention. 

1 1 FIG. 9 illustrates the user color selection feature of an exemplary embodiment of the 

12 present invention.. 

13 FIG. 10 illustrates an exemplary embodiment of a compute infrastructure suitable in 

14 accordance with the present invention. 
15 

1 6 DETAILED DESCRIPTION OF THE INVENTION 

17 Referring more specifically to the drawings, for illustrative purposes aspects of the 

18 present invention is depicted in the exemplary embodiments generally shown in Figures 1-10. It 

19 will be appreciated that the illustrated embodiments may vary as to their details, for example, 

20 representative icons (a square may be a circle), configuration (the exact screen layout may be 
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1 adjusted), etc., without departing from the basic concepts disclosed herein. The following 

2 description, therefore, should not to be taken in a limiting sense. 
3 

4 High Level Description 

5 Figure 1 illustrates a graphical representation of an exemplary embodiment of the present 

6 invention. As shown, the graphical view includes several underlying support mechanisms 

7 including: Colorized Grid of Nodes (Fig 1 - LO) being monitored, grouped for ease of association 

8 (in this example, the white lines in the grid divide the nodes by location) colored by evaluation of 

9 change status. Note: The concept of Node is not limited to a physical object and can be extended 

10 to a logical concept like a business process, object or application, a map of nodes; Baselines (Fig 

11 1 - 2.0): a selection of sets of predefined node attribute values with which to evaluate node 

12 confonnity; Groups (Fig 1 - 3.0): user defined node groupings for change and behavior pattern 

13 isolation; Pie Charts (Fig 1 - 4.0, 4.1): for providing quantitative percentage of change within 

14 the selected set of nodes for referential comparison; Time Frame (Fig 1 - 5.0, 5.1, 5.2): utilities 

15 from which to alter the time frame evaluated and presented; Auto Focus (Fig 1 - 6.0): a utility 

16 which evaluates the groups to present those with the greatest deviation from expected values; 

17 Custom Color (Fig 1 - 7.0): a utility to select the colors in which the graduated values for change 

18 appear; Rotate (Fig 1 - 8.0): providing view control; Create Report t (Fig 1 - 9.0): a report 

19 generator. 
20 

21 Visualization 
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1 Figure 2 illustrates the group selection progression of functionality listed in the 

2 description of Figure 1. It presents the group pattern identification process which consists of the 

3 primary graphical view and supporting mechanisms: Selection of Groups (Fig 2 - 1 .0), select the 

4 group to be distinguished from the enterprise node view; Identification of Nodes within Group 

5 Selection (Fig 2 - 2.0), nodes which belong to the selected Node Group are highlighted to be 

6 distinguished from the full population of nodes; Group Selection Pie Chart (Fig 2 - 3.6) provides 

7 visualization of the quantitative percentage of change within the selected set of nodes; Node 

8 View Pie Chart (Fig2 - 4.0) provides visualization of the quantitative percentage of change in 

9 full population to provide a basis with which to compare the group to the whole. This ability 

10 provides a means by which to isolate the groups with the highest rate of change. The Auto Focus 

1 1 button (Fig 2-5.0) when clicked, will automatically select and present the group with the most 

1 2 significant rate of change. 

13 Figure 3 progresses beyond group selection and into analysis of the group selection 

14 through Baseline Comparison. 1 It is not necessary to select a Group in order to select a baseline. 

15 One could look at a Baseline for patterns of change or behavior across the enterprise node view; 

16 however, patterns are more easily tracked when using both the Baseline and a Group. Figure 3 

17 and 4 combined illustrate the use of Baseline compare to quickly analyze and isolate the set of 

18 attributes which are out of range within a Group. Selection of Groups (Fig 3 - 1.0), select the 

19 group to be distinguished from the enterprise node view; Selection of Baseline (Fig 3 - 2.0), 

20 select the Baseline through which to filter the node group (this example provides a visualization 
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1 of nodes in WEB-GRP1 and how they align with the pre-established attribute-value pairs in the 

2 WEB-PATCHES Baseline). Node View (Fig 3-3.0) presents the group nodes with the status 

3 relative to the Baseline; Node View Pie Chart (Fig 3 - 4.0) continually provides visualization of 

4 the quantitative percentage of change in full population. Group Selection Pie Chart (Fig 3 - 5.0) 

5 provides visualization of the quantitative percentage of change within the baseline for the 

6 selected set of nodes (in this example, 100% of WEB-GRP1 exactly match the WEB-PATCHES 

7 Baseline. This would quickly allow a system administrator to dismiss WEB-PATCHES as a 

8 problem area and allow him or her to look for other areas in which to find root cause of change. 2 

9 Multiple Groups may be selected. 

10 Figure 4 illustrates the means with which to progress through the Baselines to identify the 

1 1 properties, or patterns, of the most intense change in the infrastructure. The group selected 

12 remains as it was in Fig 3, i.e., Web-GRPl. Since, as described in Fig 3, the User learned that 

13 the Baseline WEB-PATCHES had no changes, they move to another Baseline in an effort to 

14 identify a pattern of the change. Selection of Baseline (Fig 4 - 1 .0), select the Baseline through 

15 which to filter the node group (this example provides a visualization of nodes in WEB-GRP1 as 

16 filtered through the attribute-value associations of NT-PERF). Node View (Fig 4 - 2.0) presents 

17 the group nodes with the status relative to the Baseline; Node View Pie Chart (Fig 4-3.0) 

18 continually provides visualization of the quantitative percentage of change in full population 

19 Group Selection Pie Chart (Fig 4 - 4.0) provides visualization of the quantitative percentage of 

20 change within the baseline for the selected set of nodes. Comparing the Node View Pie Chart to 



7 of 15 



SUBSTITUTE 

1 the Group View Pie Chart indicates quickly that the percentage of change is greater in the NT 

2 PERF Baseline than the greater population and indicates an area for further investigation. 3 

3 Multiple Baselines may be selected. 

4 Figure 5 depicts the drill down from Figure 4, focusing specifically on the Node Group 

5 and Baseline selected at the point the User Drills Down. Node Group View (Fig 5 - 1 .0), 

6 presents the selected group nodes, delineated by location, with the status relative to the Baseline. 

7 The drill-down view reduces the number of nodes in the map, while leaving the remainder of the 

8 screen and its corresponding functionality intact. 

9 Figure 6 illustrates alternate 3D views of Drill Down. 3D- Z Axis (Fig 6-1.0) is the 

10 power axis and can be configured by the User to represent any key aspect of the nodes being 

1 1 monitored (e.g. CPU Power (3of CPUs * CPU Speed), # of Users, Revenue,) 
12 

13 Color 

14 The color assigned to a node is determined using a weighted moving average. Increasing 

15 the time of the sampled data for each attribute creates an average. The greater the percentage of 

16 change against that average, the greater the deviation and the greater the color shift (e.g. Green to 

17 Red). 

18 The delta time is used to compute a moving average for each sample. Time is actually the 

19 number of samples back in time, e.g., if the Daily sample is selected (as shown in Figure 6), a 
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1 delta time of 5 equates to the average of the last five days. The maximum and minimum of the 

2 averages are used to compute the entire range of possibility. 

3 For example, if a CPU attribute is selected and it is currently 25%, and the last five days 

4 it was: 90%, 10%, 50% 50% and 50%, the min is 10%, the max is 90% and the moving average 

5 is (90+10+30+35+50)/5 = 43%. Since 25 is less then 43% it will be on the green scale where 10 

6 is bright green and 43 is the midway point to red. To compute the exact color of green on the 

7 scale, 43-10 is 33 and 25-10 = 15, so 15/33 is the percentage of green on the scale. Figure 7 

8 depicts a graphical illustration of this point. 

9 Figure 8 identifies the radio button selections for time comparison (Fig 7-1.0) Daily, 

10 Weekly and Monthly. The timeframe can be customized by using the Custom Timeframe Button 

1 1 (Fig 7 - 2.0), this customization will allow complex time selections like each Monday between 2 

12 PM and 5 PM. Sliding Sample Mean Time (Fig 7 - 3.0) is used to allow the end user to change 

13 the default moving average in the computation of changes for Metrics types of attributes. 
14 

15 User Color Selection 

16 As shown in Figure 9, a user can change the colors in their view according to the user 

17 preferences. 
18 

19 Compute Infrastructure 

20 Finally, Figure 10 illustrates an exemplary network/compute infrastructure having 

21 Managers (Fig 10-1.0, 2.0, 2.1, 2.2), Managers with Gateways (Fig 10 - 3.0), Gateways (Fig 1 - 
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1 4.0), Managed Nodes with Agents (Fig 10 - 5.1, 5.2, 5.3 etc), Managed Nodes that are Agentless 

2 (Fig 10 - 6.0, 6.1, 6.2 etc), Software including application software, that can be managed like a 

3 node (Fig 10 - 7.0, 7.1 etc.), and Special Devices that can be managed (Fig 10 - 8.0, 8.1, etc). 
4 

5 CONCLUSION 

6 Having now described embodiments of the present invention, it should be apparent to 

7 those skilled in the art that the foregoing is illustrative only and not limiting, having been 

8 presented by way of example only. All the features disclosed in this specification (including any 

9 accompanying claims, abstract, and drawings) may be replaced by alternative features serving the 

10 same purpose, and equivalents or similar purpose, unless expressly stated otherwise. Therefore, 

1 1 numerous other embodiments of the modifications thereof are contemplated as falling within the 

12 scope of the present invention as defined by the appended claims and equivalents thereto. 

13 The techniques may be implemented in hardware or software, or a combination of the 

14 two. Specifically, the techniques may be implemented in computer programs executing on 

15 programmable computers that each include a processor, a storage medium readable by the 

16 processor (including volatile and non- volatile memory and/or storage elements), at least one 

17 input device and one or more output devices. Program code is applied to data entered using the 

18 input device to perform the functions described and to generate output information. The output 

19 information is applied to one or more output devices. Each program is preferably implemented 

20 in a high level procedural or object oriented programming language to communicate with a 

21 computer system, however, the programs can be implemented in assembly or machine language, 
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1 if desired. In any case, the language may be a compiled or interpreted language. Each such 

2 computer program is preferably stored on a storage medium or device (e.g., CD-ROM, hard disk 

3 or magnetic diskette) that is readable by a general or special purpose programmable computer for 

4 configuring and operating the computer when the storage medium or device is read by the 

5 computer to perform the procedures described in this document. The invention may also be 

6 considered to be implemented as a computer-readable storage medium, configured with a 

7 computer program, where the storage medium so configured causes a computer to operate in a 

8 specific and predefined manner. 

9 
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